# SEC-005: data name in a script or style

**Warning**: the page still builds, but this is most likely a mistake.

Scripts and styles are written exactly as they are: Hypra doesn't put data into them, because data in code
can become code. So `{product.id}` stays those exact characters, which is almost never what was meant.

## Fails

```hypra fails
page(title: "Shoes", description: "All our running shoes, from light racers to trail shoes.") {
  props(product: Product)
  h1 "Shoes"
  script "track('view', {product.id})"
}
```

## Fixed

```hypra passes
page(title: "Shoes", description: "All our running shoes, from light racers to trail shoes.") {
  props(product: Product)
  h1 "Shoes"
  head { script("/track.js", defer: true) }
  div(id: "product", data-id: "{product.id}") { p "{product.name}" }
}
```

Pass data in a `data-*` attribute, and read it from the script.